Materials for boards and compliance teams in organisations that use off-the-shelf AI tools. Which obligations already apply today, who has to perform them and what decides the role your organisation takes towards a given system.
Legal status: August 2026
See also: DPO and GDPR NIS2 and KSC Incidents and Breaches Training and workshops
A review of AI use cases and of your roleWhat you have to do depends on the role your organisation takes towards a given tool and on what it does with the output. Let us start with a list of the use cases already running — no obligation and no sales preamble. Explore the service
From 2 December 2026 the AI Act prohibits AI systems that generate realistic intimate material of a person without their consent and child sexual abuse material. The prohibition covers a provider where such generation is the purpose of the system or a foreseeable outcome in the absence of safeguards. It covers an organisation using a tool only where it generates such material itself.
Article 4 of the AI Act, after the July 2026 amendment, describes the obligation through measures rather than through a level of knowledge in individuals. It binds providers and deployers, has applied since 2 February 2025, and is demonstrated by describing the measures taken.
Whether a tool is a high-risk AI system is settled by its intended purpose and the way it is used, not by the product name. Two routes in Article 6 AI Act lead to high risk, and profiling of natural persons closes the derogation for Annex III use cases.
Article 25(1) of the AI Act names three circumstances in which a deployer becomes the provider of a high-risk system. The change of role follows from the way the system is used and needs no board decision. The obligations start to bind in December 2027, but what settles them are the contracts signed today.
The AI Act does not require a register of AI use cases. A central inventory is nevertheless strong evidence for three obligations — AI literacy under Article 4, the ban on prohibited practices under Article 5 and transparency under Article 50. The scope follows from those obligations, not from a template.
Article 50 of the AI Act splits the obligations by role towards the system, not by risk level. Two of the four are addressed directly to the organisation that only deploys AI — and the provider will not perform them for it.
